@oneuptime/common 7.0.4349 → 7.0.4358

package/Server/Utils/OpenAPI.ts

@@ -9,8 +9,28 @@ import logger from "./Logger";
 import { ModelSchema, ModelSchemaType } from "../../Utils/Schema/ModelSchema";
 import LocalCache from "../Infrastructure/LocalCache";
 import { Host, HttpProtocol } from "../EnvironmentConfig";
+import Permission from "../../Types/Permission";
 
 export default class OpenAPIUtil {
+  /**
+   * Helper method to check if permissions should exclude API generation.
+   * Returns true if:
+   * 1. The permissions array is empty or undefined, OR
+   * 2. The permissions array contains Permission.Public or Permission.CurrentUser
+   */
+  private static shouldExcludeApiForPermissions(
+    permissions: Array<Permission> | undefined,
+  ): boolean {
+    if (!permissions || permissions.length === 0) {
+      return true;
+    }
+
+    return (
+      permissions.includes(Permission.Public) ||
+      permissions.includes(Permission.CurrentUser)
+    );
+  }
+
   public static generateOpenAPISpec(): JSONObject {
     // check if the cache is already in LocalCache
     const cachedSpec: JSONValue | undefined = LocalCache.getJSON(
@@ -114,6 +134,12 @@ export default class OpenAPIUtil {
     const tableName: string = model.tableName || "UnknownModel";
     const singularModelName: string = model.singularName || tableName;
 
+    // Use schema names that are already registered
+    const querySchemaName: string = `${tableName}QuerySchema`;
+    const selectSchemaName: string = `${tableName}SelectSchema`;
+    const sortSchemaName: string = `${tableName}SortSchema`;
+    const groupBySchemaName: string = `${tableName}GroupBySchema`;
+
     data.registry.registerPath({
       method: "post",
       path: `${model.crudApiPath}/get-list`,
@@ -126,10 +152,10 @@ export default class OpenAPIUtil {
             schema: {
               type: "object",
               properties: {
-                query: { type: "object" },
-                select: { type: "object" },
-                sort: { type: "object" },
-                groupBy: { type: "object" },
+                query: { $ref: `#/components/schemas/${querySchemaName}` },
+                select: { $ref: `#/components/schemas/${selectSchemaName}` },
+                sort: { $ref: `#/components/schemas/${sortSchemaName}` },
+                groupBy: { $ref: `#/components/schemas/${groupBySchemaName}` },
               },
             },
           },
@@ -169,6 +195,9 @@ export default class OpenAPIUtil {
     const tableName: string = model.tableName || "UnknownModel";
     const singularModelName: string = model.singularName || tableName;
 
+    // Use schema name that is already registered
+    const querySchemaName: string = `${tableName}QuerySchema`;
+
     data.registry.registerPath({
       method: "post",
       path: `${model.crudApiPath}/count`,
@@ -181,7 +210,7 @@ export default class OpenAPIUtil {
             schema: {
               type: "object",
               properties: {
-                query: { type: "object" },
+                query: { $ref: `#/components/schemas/${querySchemaName}` },
               },
             },
           },
@@ -215,6 +244,16 @@ export default class OpenAPIUtil {
     const tableName: string = model.tableName || "UnknownModel";
     const singularModelName: string = model.singularName || tableName;
 
+    // Skip generating create API if model has no create permissions or contains Public/CurrentUser permissions
+    if (this.shouldExcludeApiForPermissions(model.createRecordPermissions)) {
+      return;
+    }
+
+    // Use schema names that are already registered
+    const createSchemaName: string = `${tableName}CreateSchema`;
+    const selectSchemaName: string = `${tableName}SelectSchema`;
+    const readSchemaName: string = `${tableName}ReadSchema`;
+
     data.registry.registerPath({
       method: "post",
       path: `${model.crudApiPath}`,
@@ -228,9 +267,14 @@ export default class OpenAPIUtil {
               type: "object",
               properties: {
                 data: {
-                  $ref: `#/components/schemas/${tableName}`,
+                  $ref: `#/components/schemas/${createSchemaName}`,
                 },
-                miscDataProps: { type: "object" },
+                miscDataProps: {
+                  type: "object",
+                  description: "Additional data properties for creation",
+                  additionalProperties: true,
+                },
+                select: { $ref: `#/components/schemas/${selectSchemaName}` },
               },
               required: ["data"],
             },
@@ -246,7 +290,7 @@ export default class OpenAPIUtil {
                 type: "object",
                 properties: {
                   data: {
-                    $ref: `#/components/schemas/${tableName}`,
+                    $ref: `#/components/schemas/${readSchemaName}`,
                   },
                 },
               },
@@ -308,6 +352,14 @@ export default class OpenAPIUtil {
     const tableName: string = model.tableName || "UnknownModel";
     const singularModelName: string = model.singularName || tableName;
 
+    // Skip generating get API if model has no read permissions or contains Public/CurrentUser permissions
+    if (this.shouldExcludeApiForPermissions(model.readRecordPermissions)) {
+      return;
+    }
+
+    // Use schema name that is already registered
+    const selectSchemaName: string = `${tableName}SelectSchema`;
+
     data.registry.registerPath({
       method: "post",
       path: `${model.crudApiPath}/{id}`,
@@ -326,6 +378,19 @@ export default class OpenAPIUtil {
           description: `ID of the ${singularModelName} to retrieve`,
         },
       ],
+      requestBody: {
+        required: false,
+        content: {
+          "application/json": {
+            schema: {
+              type: "object",
+              properties: {
+                select: { $ref: `#/components/schemas/${selectSchemaName}` },
+              },
+            },
+          },
+        },
+      },
       responses: {
         "200": {
           description: "Successful response",
@@ -369,6 +434,16 @@ export default class OpenAPIUtil {
     const tableName: string = model.tableName || "UnknownModel";
     const singularModelName: string = model.singularName || tableName;
 
+    // Skip generating update API if model has no update permissions or contains Public/CurrentUser permissions
+    if (this.shouldExcludeApiForPermissions(model.updateRecordPermissions)) {
+      return;
+    }
+
+    // Use schema names that are already registered
+    const updateSchemaName: string = `${tableName}UpdateSchema`;
+    const selectSchemaName: string = `${tableName}SelectSchema`;
+    const readSchemaName: string = `${tableName}ReadSchema`;
+
     data.registry.registerPath({
       method: "put",
       path: `${model.crudApiPath}/{id}`,
@@ -395,8 +470,9 @@ export default class OpenAPIUtil {
               type: "object",
               properties: {
                 data: {
-                  $ref: `#/components/schemas/${tableName}`,
+                  $ref: `#/components/schemas/${updateSchemaName}`,
                 },
+                select: { $ref: `#/components/schemas/${selectSchemaName}` },
               },
               required: ["data"],
             },
@@ -412,7 +488,7 @@ export default class OpenAPIUtil {
                 type: "object",
                 properties: {
                   data: {
-                    $ref: `#/components/schemas/${tableName}`,
+                    $ref: `#/components/schemas/${readSchemaName}`,
                   },
                 },
               },
@@ -432,6 +508,12 @@ export default class OpenAPIUtil {
     const model: DatabaseBaseModel = new modelType();
     const tableName: string = model.tableName || "UnknownModel";
     const singularModelName: string = model.singularName || tableName;
+
+    // Skip generating delete API if model has no delete permissions or contains Public/CurrentUser permissions
+    if (this.shouldExcludeApiForPermissions(model.deleteRecordPermissions)) {
+      return;
+    }
+
     data.registry.registerPath({
       method: "delete",
       path: `${model.crudApiPath}/{id}`,
@@ -464,9 +546,92 @@ export default class OpenAPIUtil {
     model: DatabaseBaseModel,
   ): void {
     const tableName: string = model.tableName || "UnknownModel";
+    const modelType: new () => DatabaseBaseModel =
+      model.constructor as new () => DatabaseBaseModel;
+
+    // Register the main model schema (for backwards compatibility)
     const modelSchema: ModelSchemaType = ModelSchema.getModelSchema({
-      modelType: model.constructor as new () => DatabaseBaseModel,
+      modelType: modelType,
     });
     registry.register(tableName, modelSchema);
+
+    // Register operation-specific schemas based on permissions
+    this.registerOperationSpecificSchemas(
+      registry,
+      tableName,
+      modelType,
+      model,
+    );
+
+    // Register query, select, and sort schemas
+    this.registerQuerySchemas(registry, tableName, modelType);
+  }
+
+  private static registerOperationSpecificSchemas(
+    registry: OpenAPIRegistry,
+    tableName: string,
+    modelType: new () => DatabaseBaseModel,
+    model: DatabaseBaseModel,
+  ): void {
+    // Check if model has create permissions and should not exclude API generation
+    if (!this.shouldExcludeApiForPermissions(model.createRecordPermissions)) {
+      const createSchema: ModelSchemaType = ModelSchema.getCreateModelSchema({
+        modelType,
+      });
+      registry.register(`${tableName}CreateSchema`, createSchema);
+    }
+
+    // Check if model has read permissions and should not exclude API generation
+    if (!this.shouldExcludeApiForPermissions(model.readRecordPermissions)) {
+      const readSchema: ModelSchemaType = ModelSchema.getReadModelSchema({
+        modelType,
+      });
+      registry.register(`${tableName}ReadSchema`, readSchema);
+    }
+
+    // Check if model has update permissions and should not exclude API generation
+    if (!this.shouldExcludeApiForPermissions(model.updateRecordPermissions)) {
+      const updateSchema: ModelSchemaType = ModelSchema.getUpdateModelSchema({
+        modelType,
+      });
+      registry.register(`${tableName}UpdateSchema`, updateSchema);
+    }
+
+    // Check if model has delete permissions and should not exclude API generation
+    if (!this.shouldExcludeApiForPermissions(model.deleteRecordPermissions)) {
+      const deleteSchema: ModelSchemaType = ModelSchema.getDeleteModelSchema({
+        modelType,
+      });
+      registry.register(`${tableName}DeleteSchema`, deleteSchema);
+    }
+  }
+
+  private static registerQuerySchemas(
+    registry: OpenAPIRegistry,
+    tableName: string,
+    modelType: new () => DatabaseBaseModel,
+  ): void {
+    const querySchemaName: string = `${tableName}QuerySchema`;
+    const selectSchemaName: string = `${tableName}SelectSchema`;
+    const sortSchemaName: string = `${tableName}SortSchema`;
+    const groupBySchemaName: string = `${tableName}GroupBySchema`;
+
+    const querySchema: ModelSchemaType = ModelSchema.getQueryModelSchema({
+      modelType: modelType,
+    });
+    const selectSchema: ModelSchemaType = ModelSchema.getSelectModelSchema({
+      modelType: modelType,
+    });
+    const sortSchema: ModelSchemaType = ModelSchema.getSortModelSchema({
+      modelType: modelType,
+    });
+    const groupBySchema: ModelSchemaType = ModelSchema.getGroupByModelSchema({
+      modelType: modelType,
+    });
+
+    registry.register(querySchemaName, querySchema);
+    registry.register(selectSchemaName, selectSchema);
+    registry.register(sortSchemaName, sortSchema);
+    registry.register(groupBySchemaName, groupBySchema);
   }
 }

package/Server/Utils/Workspace/Slack/Slack.ts

@@ -33,6 +33,15 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 
 export default class SlackUtil extends WorkspaceBase {
+  public static isValidSlackIncomingWebhookUrl(
+    incomingWebhookUrl: URL,
+  ): boolean {
+    // check if the URL starts with https://hooks.slack.com/services/
+    return incomingWebhookUrl
+      .toString()
+      .startsWith("https://hooks.slack.com/services/");
+  }
+
   @CaptureSpan()
   public static override async getUsernameFromUserId(data: {
     authToken: string;
@@ -1380,4 +1389,9 @@ export default class SlackUtil extends WorkspaceBase {
     logger.debug(apiResult);
     return apiResult;
   }
+
+  @CaptureSpan()
+  public static convertMarkdownToSlackRichText(markdown: string): string {
+    return SlackifyMarkdown(markdown);
+  }
 }